| CVE-2026-44578 |
high |
8.6 |
8.6 |
|
|
|
21d ago |
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
| CVE-2026-44574 |
high |
8.1 |
8.1 |
|
|
|
21d ago |
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection |
| CVE-2026-45109 |
high |
7.5 |
7.5 |
|
|
|
21d ago |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up |
| CVE-2026-44579 |
high |
7.5 |
7.5 |
|
|
|
21d ago |
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components |
| CVE-2026-44575 |
high |
7.5 |
7.5 |
|
|
|
21d ago |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
| CVE-2026-44573 |
high |
7.5 |
7.5 |
|
|
|
21d ago |
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n |
| CVE-2017-16877 |
high |
7.5 |
7.5 |
|
|
|
9y ago |
Next.js Directory Traversal Vulnerability |
| CVE-2026-44580 |
medium |
6.1 |
6.1 |
|
|
|
21d ago |
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input |
| CVE-2026-44577 |
medium |
5.9 |
5.9 |
|
|
|
21d ago |
Next.js has a Denial of Service in the Image Optimization API |
| CVE-2026-44572 |
medium |
5.9 |
5.9 |
|
|
|
21d ago |
Next.js's Middleware / Proxy redirects can be cache-poisoned |
| CVE-2026-44576 |
medium |
5.4 |
5.4 |
|
|
|
21d ago |
Next.js vulnerable to cache poisoning in React Server Component responses |
| CVE-2026-44581 |
medium |
4.7 |
4.7 |
|
|
|
21d ago |
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces |
| CVE-2026-44582 |
low |
3.7 |
3.7 |
|
|
|
21d ago |
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting |
| CVE-2025-29927 |
unknown |
— |
1.0 |
|
|
|
1y ago |
Authorization Bypass in Next.js Middleware |
| CVE-2026-29057 |
unknown |
— |
— |
|
|
|
3mo ago |
Next.js: HTTP request smuggling in rewrites |
| CVE-2026-27980 |
unknown |
— |
— |
|
|
|
3mo ago |
Next.js: Unbounded next/image disk cache growth can exhaust storage |
| CVE-2026-27979 |
unknown |
— |
— |
|
|
|
3mo ago |
Next.js: Unbounded postponed resume buffering can lead to DoS |
| CVE-2026-27978 |
unknown |
— |
— |
|
|
|
3mo ago |
Next.js: null origin can bypass Server Actions CSRF checks |
| CVE-2026-27977 |
unknown |
— |
— |
|
|
|
3mo ago |
Next.js: null origin can bypass dev HMR websocket CSRF checks |
| CVE-2025-59472 |
unknown |
— |
— |
|
|
|
4mo ago |
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
| CVE-2025-59471 |
unknown |
— |
— |
|
|
|
4mo ago |
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration |
| CVE-2025-57752 |
unknown |
— |
— |
|
|
|
9mo ago |
Next.js Affected by Cache Key Confusion for Image Optimization API Routes |
| CVE-2025-55173 |
unknown |
— |
— |
|
|
|
9mo ago |
Next.js Content Injection Vulnerability for Image Optimization |
| CVE-2025-57822 |
unknown |
— |
— |
|
|
|
9mo ago |
Next.js Improper Middleware Redirect Handling Leads to SSRF |
| CVE-2025-49826 |
unknown |
— |
— |
|
|
|
11mo ago |
Next.JS vulnerability can lead to DoS via cache poisoning |
| CVE-2025-49005 |
unknown |
— |
— |
|
|
|
11mo ago |
Next.js has a Cache poisoning vulnerability due to omission of the Vary header |
| CVE-2025-48068 |
unknown |
— |
— |
|
|
|
1y ago |
Information exposure in Next.js dev server due to lack of origin verification |
| CVE-2025-32421 |
unknown |
— |
— |
|
|
|
1y ago |
Next.js Race Condition to Cache Poisoning |
| CVE-2025-30218 |
unknown |
— |
— |
|
|
|
1y ago |
Next.js may leak x-middleware-subrequest-id to external hosts |
| CVE-2024-56332 |
unknown |
— |
— |
|
|
|
1y ago |
Next.js Allows a Denial of Service (DoS) with Server Actions |
| CVE-2024-51479 |
unknown |
— |
— |
|
|
|
2y ago |
Next.js authorization bypass vulnerability |
| CVE-2024-47831 |
unknown |
— |
— |
|
|
|
2y ago |
Denial of Service condition in Next.js image optimization |
| CVE-2024-46982 |
unknown |
— |
— |
|
|
|
2y ago |
Next.js Cache Poisoning |
| CVE-2024-39693 |
unknown |
— |
— |
|
|
|
2y ago |
Next.js Denial of Service (DoS) condition |
| CVE-2024-34351 |
unknown |
— |
— |
|
|
|
2y ago |
Next.js Server-Side Request Forgery in Server Actions |
| CVE-2024-34350 |
unknown |
— |
— |
|
|
|
2y ago |
Next.js Vulnerable to HTTP Request Smuggling |
| CVE-2023-46298 |
unknown |
— |
— |
|
|
|
3y ago |
Next.js missing cache-control header may lead to CDN caching empty reply |
| CVE-2022-36046 |
unknown |
— |
— |
|
|
|
4y ago |
Unexpected server crash in Next.js |
| CVE-2022-23646 |
unknown |
— |
— |
|
|
|
4y ago |
Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 |
| CVE-2022-21721 |
unknown |
— |
— |
|
|
|
4y ago |
Denial of Service Vulnerability in next.js |
| CVE-2021-43803 |
unknown |
— |
— |
|
|
|
5y ago |
Unexpected server crash in Next.js. |
| CVE-2021-39178 |
unknown |
— |
— |
|
|
|
5y ago |
XSS in Image Optimization API for Next.js |
| CVE-2021-37699 |
unknown |
— |
— |
|
|
|
5y ago |
Open Redirect in Next.js |
| CVE-2020-15242 |
unknown |
— |
— |
|
|
|
6y ago |
Open Redirect in Next.js versions |
| CVE-2020-5284 |
unknown |
— |
— |
|
|
|
6y ago |
Directory Traversal in Next.js |
| CVE-2018-18282 |
unknown |
— |
— |
|
|
|
8y ago |
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page |
| CVE-2018-6184 |
unknown |
— |
— |
|
|
|
9y ago |
Directory traversal vulnerability in Next.js |
